CVE-2026-49337 Details
Description
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::read_slice_NAL()` (`libde265/decctx.cc:481`) to attach slice headers to a finished picture object that has no active image unit, resulting in attacker-controlled unbounded heap growth. The retained headers are never freed until the picture is released, which may not happen during continuous streaming. Version 1.0.20 patches the issue.
A memory leak vulnerability has been identified in libde265, an open-source H.265 video codec implementation, affecting versions through 1.0.19. The issue arises in the decoder_context::read_slice_NAL() function, where a crafted sequence of H.265 NAL units can cause slice headers to be attached to a finished picture object that lacks an active image unit. This leads to unbounded heap growth, as the retained headers are not freed until the picture is released, which may not occur during continuous streaming.
Users can upgrade to libde265 version 1.0.20, which addresses the vulnerability by freeing orphaned slice headers when no active image unit is present.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libde265 | <= 1.0.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |